search

googleapis / repo-automation-bots

A collection of bots, based on probot, for performing common maintenance tasks across the open-source repos managed by Google on GitHub.
Apache License 2.0
626 stars 126 forks source link

Flakybot does not appear to accept external_account permissions #2752

Closed JustinBeckwith closed 2 years ago

JustinBeckwith commented 3 years ago

I am trying to use Flakybot along with GOOGLE_APPLICATION_CREDENTIALS in a GitHub Action using our WIF/OIDC provider. The credential file for OIDC will look something like this: https://github.com/googleapis/google-auth-library-nodejs/blob/main/test/fixtures/external-account-cred.json

I am getting this error from flakybot while trying to use it:

[FlakyBot] Unable to connect to Pub/Sub: pubsub: google: error getting credentials using GOOGLE_APPLICATION_CREDENTIALS environment variable: unknown credential type: "external_account"

The failure is here: https://github.com/GoogleCloudPlatform/nodejs-docs-samples/runs/3972078689?check_suite_focus=true

And the CI config here: https://github.com/GoogleCloudPlatform/nodejs-docs-samples/blob/main/.github/workflows/healthcare-datasets.yaml#L41

tbpg commented 3 years ago

@codyoss this seems like an issue in cloud.google.com/go auth?

codyoss commented 3 years ago

Has this app been redeployed recently to take advantage of dep updates? This flow *should work with a modern version of the oauth2 library, which looking at the go.sum should be being pulled in.

JustinBeckwith commented 3 years ago

At a glance, it looks like the flakybot binary on gcs is wildly out of date?

gs://cloud-devrel-kokoro-resources/trampoline/linux_amd64/flakybot:
    Creation time:          Mon, 25 Jan 2021 18:14:10 GMT
    Update time:            Mon, 25 Jan 2021 18:14:10 GMT

@tbpg is it possible this binary is manually pushed to GCS? FWIW, I would much rather us have a public release on GitHub with the binaries attached :)

tbpg commented 3 years ago

is it possible this binary is manually pushed to GCS?

That is 100% the case. I just uploaded a new version. @JustinBeckwith, give it another shot?

$ cd repo-automation-bots/packages/flakybot
$ make upload

FWIW, I would much rather us have a public release on GitHub with the binaries attached :)

+1. I filed #2789 to track.

chingor13 commented 2 years ago

This looks like it's working: https://github.com/GoogleCloudPlatform/nodejs-docs-samples/runs/4425468063?check_suite_focus=true